Samsung S5PC100, Руководство пользователя

Страница: 324 / 1863

CORESIGHT S5PC100 USER’S MANUAL (REV1.0)
3.2-6
1.3.1 Authentication for Secure JTAG Operation
S5PC100 supports Secure JTAG by using authentication signal of cortexA8 & coresight system.
And the Secure JTAG mode can be set by programming 5
th
e-fuse block.
Though total number of bits of 5
th
e-fuse rom is 96bit, only 82bits are used for SecureJTAG function.
•
[79:0]: Secure JTAG hash key
•
[80]: Secure JTAG lock on
−
0: non-protection, 1: protected by secure JTAG
•
[81]: Secure access type after authentication
−
0: secure access, 1: non-secure access
Before authentication, the debugger should access to internal authentication module in security sub system. In
S5PC100, the AHB AP of coresight provides path for internal module to debugger as depicted in Figure 3.2-4.
If Secure JTAG lock on bit is programmed as “1”, the authentication signals such as DBGEN, NIDEN, SPIDEN,
SPNIDEN are all “0” before passing authentication
AXI_D0 (64b, 3x3) @ 166MHz
DMC0
SEC
SS
AXI_B0 (64b, 4x2) @ 166MHz
ARM
AXI_C0 (32b, 2x7) @ 166MHz
LPDDR1 @ 166MHz
[0]
[0]
<0>
<0> <1>
[1]
[1] [2]
<1> [5]
CSSYS
(AHB AP)
[6]
JTAG
detector
Authentication path
DBGEN
NIDEN
SPIDEN
SPNIDEN
DBGEN
NIDEN
SPIDEN
SPNIDEN
Access
controller
SecAccessEn
NSecAccessEn
SMode
JTAGDetect
DBGEN = 1
NIDEN = 1
SPIDEN = 1
SPNIDEN = 1
* CSSYS
’
s authentication ports are tied up to
“
1
”
, while CortexA8's
authentication ports are controlled by Secure JTAG
Memory
sub
system
Figure 3.2-4 Secure JTAG Scheme in S5PC100
At that time, because the AHB AP’s address ports are muxed with tied value for the address of authentication
module, the debugger can access the authentication module in security sub system through the AHB AP of
coresight.
By writing the passwords in predefined sequence, the authentication can be done. After authentication, the
authentication signals are selectively asserted as defined in Table 3.2-1.